2026年5月5日の
セキュリティ情報

Subject: [Security Alert] Addressing Authentication Failures in Exposed AI Services

Dear IT/Security Team,

We are sharing critical information regarding security vulnerabilities in AI infrastructure deployments.

■ Overview
Recent research has revealed that a vast number of AI services (including Ollama, Flowise, n8n, and OpenUI) are exposed to the public internet without authentication. This leads to severe risks, including the leakage of sensitive chat histories, exposure of API keys, and potential Remote Code Execution (RCE) due to insecure default configurations.

■ Scope
- Any self-hosted AI chatbots, LLM APIs, or Agent management platforms accessible from the internet.
- Specifically, environments utilizing open-source tools like Ollama, Flowise, n8n, and OpenUI.

■ Mitigation Steps
1. Audit all public-facing ports associated with AI services (e.g., port 11434 for Ollama) to ensure they are not unintentionally exposed.
2. Verify that authentication mechanisms are explicitly enabled and configured with strong credentials/API keys.
3. Restrict access to AI services by moving them behind a VPN or an identity-aware proxy rather than exposing them to the public internet.
4. Implement the principle of least privilege for AI agents, specifically restricting dangerous capabilities such as local file writes or arbitrary code execution.

■ Reference
- Intruder Security Research (AI Infrastructure Exposure)

Priority: High
Deadline: Immediate review and remediation of any identified gaps.

Subject: [Security Alert] Beware of Sophisticated Phishing Emails

Dear employees,

We have observed an increase in sophisticated phishing emails that bypass security filters by exploiting trusted cloud services (Amazon SES).

What we need from you:
1. Be cautious of emails containing unexpected invoices or links, even if the sender appears legitimate. Verify with the relevant department before clicking.
2. Never enter your credentials or personal information into forms linked from unexpected emails.

Deadline: Immediate / Ongoing

件名: 【共有】Amazon SESを悪用したフィッシング攻撃への対応について

お疲れさまです。Amazon SESを悪用したフィッシング攻撃に関する情報共有です。

■ 概要
攻撃者がTruffleHog等のツールで漏洩したIAMアクセスキーを収集し、Amazon SES経由でメールを送信しています。AWSのインフラを利用するため、SPF/DKIM/DMARC等の認証を通過し、レピュテーションベースの遮断を回避する傾向があります。

■ 影響範囲
- AWS IAMアクセスキーを管理している全開発者・運用者
- AWS SESを利用している組織

■ 対応手順
1. IAM権限の再点検を行い、最小権限の原則（Least Privilege）を適用する。
2. 全ての特権アカウントに多要素認証（MFA）を強制適用する。
3. 公開リポジトリ（GitHub等）やS3バケットにアクセスキーがハードコードされていないかスキャンを実施する。
4. アクセスキーの定期的なローテーションを自動化・徹底する。

■ 参考情報
- Kaspersky Threat Intelligence Report

対応優先度: 高
対応期限: 今週中

Subject: [Technical Alert] Phishing Campaigns Leveraging Amazon SES

Dear Security Team,

This is a technical update regarding phishing attacks utilizing Amazon SES to bypass email authentication protocols.

■ Overview
Threat actors are using automated bots (based on TruffleHog) to harvest leaked IAM access keys from public sources (GitHub, S3, etc.). By using Amazon SES, they can send emails that pass SPF, DKIM, and DMARC checks, effectively neutralizing reputation-based filtering.

■ Scope
- Organizations managing AWS IAM keys
- Users of Amazon SES

■ Mitigation Steps
1. Audit IAM permissions and enforce the Principle of Least Privilege (PoLP).
2. Enforce Multi-Factor Authentication (MFA) for all IAM users.
3. Scan public repositories and environment files for leaked secrets using tools like TruffleHog or GitLeaks.
4. Implement a strict rotation policy for AWS access keys.

■ Reference
- Kaspersky Threat Intelligence Report

Priority: High
Deadline: End of this week